e280d2c1d4c0eee5e9f2b360118f19e7fbf664f71a388653c0072f101bc86f0d

Resubmissions

21/07/2026, 19:18

260721-xz5h2sgr7w

21/07/2026, 18:42

260721-xcdf2sgp7v3

21/07/2026, 18:40

260721-xbmy4agp513

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
External Fortnite/run.bat
Size 1.2MB
Sample260721-xcdf2sgp7v
SHA256 e280d2c1d4c0eee5e9f2b360118f19e7fbf664f71a388653c0072f101bc86f0d
MD5 45da7a54d831e10bd76f2a744d44f8e1
SHA1 582d84cc5fb3de533cd900e4f0e82f03d6ade66f
SHA512 20ee0ce0d2aef77dab1241d8969410eb93098268f846e67866fb71cdc0d14bbbede18dd8e5f335ad4511184d1935b329e8d8d27f280121858c8c1a558bdc47aa
SSDEEP 24576:VGVG0IYSVewbc2KMwkF8PrU4dlLPoltR+E4yu7RI+t:kjuVjGHdxPoGa+t
TLSH
T178552234ADDF3CFE4670892AB4E6884B3FF94CD3497854DC42DFA0832B4EA668D65161
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
756	cmd.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\DisplayName = "Chrome Sandbox"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Children	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096\Moniker = "fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\fx.sb.cdmaead3483b5e3a557227b77554c4d4739fd53e90f\Children	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	firefox.exe
Token: SeDebugPrivilege	4160	firefox.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe
4160	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4160	firefox.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4160	4500	firefox.exe	91
PID 4500 wrote to memory of 4160	4500	firefox.exe	91
PID 4160 wrote to memory of 2872	4160	firefox.exe	92
PID 4160 wrote to memory of 2872	4160	firefox.exe	92
PID 4160 wrote to memory of 2872	4160	firefox.exe	92
PID 4160 wrote to memory of 3568	4160	firefox.exe	93
PID 4160 wrote to memory of 3568	4160	firefox.exe	93
PID 4160 wrote to memory of 3568	4160	firefox.exe	93
PID 4160 wrote to memory of 3568	4160	firefox.exe	93
PID 4160 wrote to memory of 4616	4160	firefox.exe	94
PID 4160 wrote to memory of 4616	4160	firefox.exe	94
PID 4160 wrote to memory of 4616	4160	firefox.exe	94
PID 4160 wrote to memory of 4616	4160	firefox.exe	94
PID 4160 wrote to memory of 4004	4160	firefox.exe	95
PID 4160 wrote to memory of 4004	4160	firefox.exe	95
PID 4160 wrote to memory of 4004	4160	firefox.exe	95
PID 4160 wrote to memory of 3476	4160	firefox.exe	96
PID 4160 wrote to memory of 3476	4160	firefox.exe	96
PID 4160 wrote to memory of 3476	4160	firefox.exe	96
PID 4160 wrote to memory of 3476	4160	firefox.exe	96
PID 4160 wrote to memory of 5380	4160	firefox.exe	97
PID 4160 wrote to memory of 5380	4160	firefox.exe	97
PID 4160 wrote to memory of 5380	4160	firefox.exe	97
PID 4160 wrote to memory of 5380	4160	firefox.exe	97
PID 4160 wrote to memory of 5536	4160	firefox.exe	98
PID 4160 wrote to memory of 5536	4160	firefox.exe	98
PID 4160 wrote to memory of 5536	4160	firefox.exe	98
PID 4160 wrote to memory of 5536	4160	firefox.exe	98
PID 4160 wrote to memory of 5556	4160	firefox.exe	99
PID 4160 wrote to memory of 5556	4160	firefox.exe	99
PID 4160 wrote to memory of 5556	4160	firefox.exe	99
PID 4160 wrote to memory of 5556	4160	firefox.exe	99
PID 4160 wrote to memory of 5636	4160	firefox.exe	100
PID 4160 wrote to memory of 5636	4160	firefox.exe	100
PID 4160 wrote to memory of 5636	4160	firefox.exe	100
PID 4160 wrote to memory of 5636	4160	firefox.exe	100
PID 4160 wrote to memory of 876	4160	firefox.exe	105
PID 4160 wrote to memory of 876	4160	firefox.exe	105
PID 4160 wrote to memory of 876	4160	firefox.exe	105
PID 4160 wrote to memory of 876	4160	firefox.exe	105
PID 4160 wrote to memory of 1976	4160	firefox.exe	108
PID 4160 wrote to memory of 1976	4160	firefox.exe	108
PID 4160 wrote to memory of 1976	4160	firefox.exe	108
PID 4160 wrote to memory of 1976	4160	firefox.exe	108
PID 4160 wrote to memory of 2952	4160	firefox.exe	109
PID 4160 wrote to memory of 2952	4160	firefox.exe	109
PID 4160 wrote to memory of 2952	4160	firefox.exe	109
PID 4160 wrote to memory of 2952	4160	firefox.exe	109
PID 4160 wrote to memory of 5512	4160	firefox.exe	110
PID 4160 wrote to memory of 5512	4160	firefox.exe	110
PID 4160 wrote to memory of 5512	4160	firefox.exe	110
PID 4160 wrote to memory of 5512	4160	firefox.exe	110
PID 4160 wrote to memory of 5208	4160	firefox.exe	114
PID 4160 wrote to memory of 5208	4160	firefox.exe	114
PID 4160 wrote to memory of 5208	4160	firefox.exe	114
PID 4160 wrote to memory of 5208	4160	firefox.exe	114
PID 4160 wrote to memory of 3792	4160	firefox.exe	115
PID 4160 wrote to memory of 3792	4160	firefox.exe	115
PID 4160 wrote to memory of 3792	4160	firefox.exe	115
PID 4160 wrote to memory of 3792	4160	firefox.exe	115
PID 4160 wrote to memory of 5696	4160	firefox.exe	116
PID 4160 wrote to memory of 5696	4160	firefox.exe	116
PID 4160 wrote to memory of 5696	4160	firefox.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\External Fortnite\run.bat"
1⤵
- Executes a command shell one-liner
PID:756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5004

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {e6147f0c-8776-4d3f-86f8-4b26c53e7467} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2460 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {4e85c3bf-5b10-40da-a7a8-f00bb8efdb70} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:3568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27276 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {78b460ee-d293-459a-b823-7685cfe7caf5} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27276 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {1e45e1b0-da9e-4660-9ebe-8e0eb9eea26c} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4408 -prefsLen 34775 -prefMapHandle 4412 -prefMapSize 270279 -jsInitHandle 4416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4424 -initialChannelId {97d600f2-6131-4030-bf5f-db660b84d41c} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:3476
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5004 -prefsLen 35091 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 5000 -initialChannelId {e48f80f1-0a27-44a3-828c-0e213e295e0c} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5224 -prefsLen 33031 -prefMapHandle 5228 -prefMapSize 270279 -jsInitHandle 5232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5240 -initialChannelId {49ff7ba1-c792-4a1f-9a24-3aab2461d7ba} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 33031 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {e35b0fea-ed2d-40d8-bdf8-b5efaece38d9} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5720 -prefsLen 33031 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5476 -initialChannelId {05c41afb-f78d-4aa5-ad65-5bed1fcb956b} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4272 -prefsLen 33031 -prefMapHandle 4276 -prefMapSize 270279 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6100 -initialChannelId {fa2fb172-b80b-489f-adb0-175bcb30ed32} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6476 -prefsLen 35143 -prefMapHandle 6480 -prefMapSize 270279 -ipcHandle 3316 -initialChannelId {1f63c052-5196-43ee-999d-62c5b062b8c3} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
    3⤵
    - Checks processor information in registry
    PID:1976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6608 -prefsLen 33031 -prefMapHandle 6612 -prefMapSize 270279 -jsInitHandle 6616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6624 -initialChannelId {06103168-2bc7-4201-b3db-c7e68d2d804d} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:2952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6920 -prefsLen 33031 -prefMapHandle 6924 -prefMapSize 270279 -jsInitHandle 6928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6576 -initialChannelId {6a0e22a3-3681-4019-bd28-2345063d6a22} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:5512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5724 -prefsLen 33031 -prefMapHandle 6032 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {c2423935-ff23-4054-afb6-8fb07c26e4de} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6612 -prefsLen 33031 -prefMapHandle 6896 -prefMapSize 270279 -jsInitHandle 6616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {8026c8aa-2d1a-4f0e-b713-ea822038eb8c} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:3792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 6896 -prefsLen 35587 -prefMapHandle 7128 -prefMapSize 270279 -ipcHandle 7208 -initialChannelId {ebb36c56-1187-4b59-9cca-e450abc420f9} -parentPid 4160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4160" -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility
    3⤵
    - Checks processor information in registry
    PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 a3fdd7c6130fa7aecf0f253d236b95fad76620f3aae59cf817929dc4281bbd6e
MD5 36c0e0034b3446997336a48725d68f57
SHA1 1fafe6889b9d47bf4ddb31bbc65b13a86899d06c
SHA512 6ae09467bdad84ffb4e42864c2baed8fa3cb30a45820655255b12779b5b3487ff2bad5ee6a5ae60d17052e088d31ed2a7e6726b1f35b72bf30f954c0592a7642
SSDEEP 384:HwCe7iO024Yedcs3hk2nhfdDE2Ba/rIVy8epQH+9QH+g:QqZYedv3hk2nhfS2sDIVy8qS+9S+g
TLSH
T171728DBBDF516C5D1A17D585C8A99766DC05F9AB8FF690B608203049CB8432AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 65c45f17f33fa3aca3fd51598315b8d0a3708db1fcec579427b2604fdede1b2d
MD5 d0ee8d2b53557de32d7bc087eff8b293
SHA1 7f79319c9bf0f1ef84971b690acc582c0b7dbc09
SHA512 5c14c59ee2b8a47b81da5aa3b449d605edb7b263375a323e055465f9bc778cab83302dc1b58476a25c8008358d3e9da0c1ed50469da84b43c726e5bc6cceac1a
SSDEEP 384:H9XghOiO024Y4dcs3hk2nhfdDE2Ba/rIVy8eJKk:dX+ZY4dv3hk2nhfS2sDIVy8m
TLSH
T191728E7B9F106C5E19679585C8AD9369DC05FDABCBF290B608243489CB8432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 23KB
SHA256 204b3f8aa8c6fa5862cd113754a248efab173d71c880e36b919c6f0797c4f342
MD5 ab736a65d96836182f979906d53c54d2
SHA1 325f6880b537fc3967bd779ed75c31582b182d91
SHA512 b2b49f15f9bc4ad8d76d2547d0d3a9faa330aca65eb0f6ab7ab10224349344be3443aecb7917a4ec616d72755d94cadb171dba520e0b43278e05f4887fda7b90
SSDEEP 96:hb+bzgbgztbPbLbrbfb6ebudMb3ebVKPbnb7brpebvpf+xbqETbXEbETbrTbMslx:uuGUgLssbBYv
TLSH
T1AAB225F79AB564D1F0629FF44098789D8823422F5CE4C5E4CA04E8D7127B7A4D06EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 26KB
SHA256 a9bf495088d81330c3d4a14c15ddb07619c9c762a667fe83216565d056bcb633
MD5 af572c167cf0ac1cba7a0d8eeb40a536
SHA1 e08e6a312635004a4a33aa1ecdae0ebbbb3648a1
SHA512 b0115a72fbedeb8ff479e7709166460bda53074ca555004945f0c482915b7ec6227b365fcf31cec75c5f7f3d3e3cd3e415e206b108fe8cd07bc90615eb4ef285
SSDEEP 96:oqTbVVubODbV0bzgbgztbebWbrbfbRbFbOebudsb7ebVKvbbbbbXpebvpf+FbqED:F1V7FCuWUgLssbBYv/qR59
TLSH
T16BC248F3ABB524D1F0519FB40088789D9833422B4CE4C5A4DA14E4DB16BE7A4E06EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 28KB
SHA256 b519ad3e0faabc917219971d078092c738583497d98cee59a92adc7b03804e2b
MD5 79c2f7473a5e4d71b33ec2732edbf37e
SHA1 e7610753e2e74a72f34f92655fc2ae233c4da39a
SHA512 b03213539628efc9dc12995328270982dbfad27a6d6b11f0e8c1b5ff6156c42443837c7e1297dcbb7c56b8b43d10d6f34cf2bcc9e029554052993d70c369996f
SSDEEP 96:MTbVVPbHDbV9bzgbgztbPbnbrbfbfbDbOebudsb7ebVKvbbbbbXpebvpf+FbjET0:M1VbF5uZUgZssWFrBUvARl9y6X3
TLSH
T13BD237F76BB514C1F0219FB44095384D9833822B5CE4D4A4DA14E4DB16BFBA8D06EFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\AlternateServices.bin
Size 10KB
SHA256 1d965430c8099675f3972e3b67a5e2b531bdee90e37b35e967ce54554550a8c3
MD5 4429c726a39563642b94f16139b88a6e
SHA1 d89bbc447d0920acdf9e74c906e16e3f02950251
SHA512 8d72c8120fcd551a27875eaf11f7511886a8371d3be56919467fec4942fda6462e2c6effe790b8b49a719234ecfbeace4e997e55c38913f3f29de3eb7f494151
SSDEEP 96:BebOJybjbTblgbgzDbnbTbvb/b7bbb6ebudMb:
TLSH
T18F22F6F79BB554A1F0A29FF84058788D8C23421E5C98D5B4DE04E4D326BBBA4D03EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 296914146802d0f35d8c048cdafd8f47512a8cdc0202053d6656fd8c10be06bb
MD5 f733c07d574cfede1a0f136cd977b254
SHA1 c8d8ea95dcf4d4be57ac3e2d9c19ac99be784017
SHA512 4279c3c1d9d1b0590a405b30ebcba1cbd59a92ba373d60d8bc9f44f3acf7a9cf7225877863ac92913d7594d68a9a89a3b9dbd13f19462df8c20f97e31fe310c8
SSDEEP 192:B1d66JozGzgCl6mc0djOv5zboPIVtyjii:/d66JozGzgC1j6bogVtyj
TLSH
T1D6F11D68E728863BC408027BCCA61B414F39389A9C4E7F29369C701C2D576DE76DE17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 5eeb28ecc19fd86e29389301e67bacef7b11f69fafa44ce77c460949e9996e2a
MD5 49c6c3d00fc39dbf3470e55055936c80
SHA1 812cc6b023dc37a779c3278077c0d19e6b56e7c0
SHA512 bb073ab97d3d03938812b03f887da2167b3bbd4ae37bbcb29af9078c936690965f8b516926673e9b25d66bda14bfed4873cf4957de62a03a6c27e3d59444b0ca
TLSH
T184619758F2288A3FE4444139CC961F411F747456A8AE3F2A39ACA08D1E5B2CE76CE13D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3476f319db19fa96c80264c72de62196dfb82fdb571ab6e6fbc5ff9e78e4d77a
MD5 606e339561016b20f4d30b6b01294aec
SHA1 2c3cc666d8cfbfcd868773e6165028d56dd168fb
SHA512 2ead9c4497415a3b49241e3111ffebad13e727e8ec51eb71057122595b40f47978deb0f53813e1fe34fa2ac434333738ded505027c630d5c3064f2f5e2efb7ef
SSDEEP 192:w1d66JozGzgCl6mc0dEOv5zbojZVtyjii:qd66JozGzgC1jVbojZVtyj
TLSH
T1A4E10C68E728863BC404027BCDA61B414F39389A9C4E3F29369D741C2D576DE76CE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0f6aa879c41d0b62ff86cf26e2708919a5474124070547093fdb9ced7d63cad3
MD5 b153a9128c366db9367f0d093427395a
SHA1 eb8c1430c0dffe752b48e2c73a60b7399d23ea71
SHA512 748f9e29103157617765170bf24fde7c82936f185efa51f8f5840641dd07ef71c1e39f8c917b07388b7d9cb7e9cc74d9006185c9a1cd147badb70ce5fd8a04b6
SSDEEP 192:COv5zbowbVtyjiiC1d66JozGzgCl6mc0dz:hbowbVtyjSd66JozGzgC1jd
TLSH
T1B6D11E68E728863BC444433BCCA61F414F39389A9C4E7F29369D64082D576DE76CE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 6KB
SHA256 aecc3a4f730f5f180764d97364ed7d6fefb822691f7e135fbf6ca3ff0d045073
MD5 643e6dc8db72dd21efae582d135ab5a8
SHA1 487e601255acb6bb038ae53f8e1ff5aac858e25e
SHA512 d007453a6f11630e331bef556b23dc15da6f7469cf2b749ed2ee62776b4a7613d306156615235f7c20ea775550ca40d4cba0f6d703e5b70f43872aae65323504
SSDEEP 96:FzW9X1OFPEJsXMCVz+K3D3x9fy7LdH7dJyqQJxTRl2s/87lVMs7JbZVy:Fi/OCsXMtKrg5OVR9sJJi
TLSH
T153D1BF1E76B64CF95E87F29CEC80078D539946434CC62F831CB2EE5C8C9AA56726F12D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a0c3ce5a6faf3a7ded7459119d414c5ad682d9e6682c49e0974640e5ec12b3fa
MD5 629802b4410de96072f44d8d701252d5
SHA1 d2f2d3a0f2f25c7e5b4810075495738a79d0b22a
SHA512 9f63aae6dfcca70aaeb5cba1b0273b11d3aea78181537b132a17f1d0eaf543ec0f19207baf93e0f17b3b9675f7287c35a176281d44cc921cc19e0a0c08526f83
TLSH
T1AB216D6C39F84DEA6886E69CB481318E53544E474C872C430E22FF8DDE85ADD71AA439
MD5 SHA1 SHA512 TLSH

Submit Download

201fc047-3b10-42fa-ae9e-cdacb6e8c429

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\201fc047-3b10-42fa-ae9e-cdacb6e8c429
Size 886B
SHA256 85c1359897fac30a4a3e5682d522203926d6e3038e477fb89dcb23e6ee887f45
MD5 b16c4c47e148e01c1175491801ac9605
SHA1 163d28fb55deea1d969e41f1b63e5c5dea014ee5
SHA512 fb3a9997b716588781d119c4b0ea549c50832bf0da76b9cbb3e4da04d3a1d910f06149368cdc638b2cce752f71934e012004916ca2604e9fc1ddd8b2e3ade7f9
TLSH
T1D51127504774B9B2CC58C24BCAE077424FE4B513C0C658147ED51B180DBA51F93E7307
MD5 SHA1 SHA512 TLSH

Submit Download

92f45041-e1c8-4526-8ecc-e1709172cc98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\92f45041-e1c8-4526-8ecc-e1709172cc98
Size 2KB
SHA256 06d56f55be5c02e3074de3eceddabbcfcac4bf88bb098db81274017653acc285
MD5 e7a10a8806c73b9c1f924794d4f88986
SHA1 1d157a14e726659b597f7b65595b6fd997c793c4
SHA512 8efdae6133322bb99232c8a3fe89611d546baaad669a2c4de5f3c5ee1ce8dbd2b53bdef15de65b81c7acb56ada004952ed56d4f4a41bc5a9faf4b0401b84f446
TLSH
T18841251C39785DB6C8DAE19DDC81234D57688A5340C52C532F52DE0CCC9679A236A53A
MD5 SHA1 SHA512 TLSH

Submit Download

ae5c0551-4cd5-4076-be62-72fb3858382e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\ae5c0551-4cd5-4076-be62-72fb3858382e
Size 15KB
SHA256 713cd74b52641aab097a6f1a83ae3d09a45eefcf8098bab4d7f4fa8c3f76ff81
MD5 6d3ccb17abc2f19d8a410caec604a69d
SHA1 ef9a51c82645d593c300c51ff090cf25a998c1e5
SHA512 823688def3ce26492f4070cdebb407bc6faedf3bf5bfb712b5f695bd3acdca380dfe9b3dbf5ca177af10e780dd0ebd6469b3b7c31f388cd053d5e21f9701b8b0
SSDEEP 192:ctFbwb9aR9suT1PywBSN+YzTDh+bR7GoPNggFSVlsFIZV7B7B/NqeEWS4dllkzUM:sFkb9ZA5cN+YH1+bR7GENgPlsiZFc
TLSH
T19272C8166860557A8251E368D8F8BFC3E6F528CB4C019FCEDBE4BE0859DE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf3830f0-eac1-43b9-9d9a-46c42bc202ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\bf3830f0-eac1-43b9-9d9a-46c42bc202ff
Size 13KB
SHA256 ce353f77f722c0b25f708587cd199ad6d8c2e298e76044d3a705404aad72628c
MD5 b40fc20a98747c395ace2ae03d97ac92
SHA1 004fc62c47d76fe463bda6cb93afdd4fb0ab7987
SHA512 e8f8da865510c44ecea009e741a44edcbf241790adc60df4b712e387681a9649401a008960299f515c458fa431db30b6c80c79f3770f948aad7f63e76771bfe0
SSDEEP 96:kv7KNtUlwpSGOed/wF3/dAV/Gqmok9j+UlR0232bH+rKPnZ7Mp7mZtSMMWUc+8vE:kvw+BtCF40wyX+h3R8KsSYI3TWGd
TLSH
T1D352DDFEDD2241433A66F62DF1A9EDAB105A293109C8879D6BEC0C3A37D2EB71513314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1d11f70-bb5d-42ab-b5aa-bc19b929de99

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\c1d11f70-bb5d-42ab-b5aa-bc19b929de99
Size 235B
SHA256 f15142f32b1f591d4d677206a329e671089538e8b9627558dba56748279d2f32
MD5 fc6599f53c1498452b99f49bf33e789d
SHA1 6d80bc8ae4f5f34e75912abfa4c0023a36ef2818
SHA512 b98522375e35e093a725374e7ed61f22e49cf8b4dd14af13ff41eb77887fc5b2a1d77a805941dc82f4c9aa31b037bc9339c8d069bcd068751b5c26ac4f3c9f10
TLSH
T131D0A78524A8B76D48240F1AF0A1BDC630884C3714A468A0AA5185789AFADCC4271AAB
MD5 SHA1 SHA512 TLSH

Submit Download

da19793c-fb79-4b92-9079-28600a5d4f2f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\da19793c-fb79-4b92-9079-28600a5d4f2f
Size 883B
SHA256 c08a8e2a437415b14508dfbc98021120f1eee37682c4063db5cffe72f6d9c649
MD5 dd8d281a5303234d10d199bd3145ebc8
SHA1 3c4d58fa71f8f7454fd8c9af9d8dbdb15cda1399
SHA512 89d18134e17f17fa8976e7d53aaf5cb0cd25d57b26916bce86198547603ed1e4c44903abb52522d62a3be34394a841e6e6c76bb716595aae1a07228502e50a3e
TLSH
T1E01127555774B9F2CC78C34BCA913B015FE4B61380C954143FA55D180D7F91E939B20B
MD5 SHA1 SHA512 TLSH

Submit Download

e31bf10f-844c-4fd1-bb61-c0f55ecc4a04

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\e31bf10f-844c-4fd1-bb61-c0f55ecc4a04
Size 235B
SHA256 254e5eff0fce1354bd01b90455522a28585bf4651b1f18ec1a0eaef7f909535a
MD5 b1d0c962b9f7bcdbc1c90b8fc3c24945
SHA1 5313a73f845821c9b0d2ad686dba77089420b3fc
SHA512 d19bcac1e540e8523e33f6ca9cfbc91fcdffa0ec9efc106bb533d96c87d51f3efc38f3b3885435d5b40f78671e762f1b2412f7c3ccc09961af13dd9fc855881c
TLSH
T195D097803898637D08140F02F0F229C330684C335060982199608574CDFD9DA815291A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 506eb42acfca587cac3b10668132be274683dbb1dba3987bf6227bbc35be42be
MD5 e178aa3d0670f77fb0cbd6b9e1af7d87
SHA1 ecfd32a1ebcb1f18b2d28029f309219bb6dd1832
SHA512 f8529545f2955c13940020d10b95787742c1947d28014797d2f8d5cf3b245fbe23af6366e2f5fa99bd46ad99e20bbe6e90a0ee7416c33b6405d79afd1d064ae3
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4HkE4hH:mI4dRfFXQ4d614d4D4J4+4l4B
TLSH
T19172421545048EB8294E979BAA367E01C37D533B60845C78F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 6a93ddd04c014814e751d79973f1e19d25f7cd1f752b96043ab2065452ebad0e
MD5 723274fce7b2f92939de7e570d7f175a
SHA1 c139d5ff6dac7a7be545f48cbb2d1174e556ef46
SHA512 7abbbdcdcc40c9ef764e1c220e5b6466a21ff3dd85231dbdddf1577b7d96ea13542f1dc55ad3c1fd7d3b6c8ffc54ca288505146378870474c77cc36ae1abbd89
SSDEEP 96:xH4fUTUOPqGqsWf2e1b11zSGSSladv9jEnIHeABw88n8L4cnTDEMGS:mf5RsWf26hzSSKeABw88qv
TLSH
T18BE1107895188F6F64B677ACAC6888316AB2413B7BBF68D610B95484011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 8KB
SHA256 5a16ff7f19b567cc0767f1016cd93adf8219255e67473b586c8462560e0524d0
MD5 f5119daf8951e2055f2d98b09563ab4a
SHA1 576719e29fa7fce4991d228d019a24423e34c6df
SHA512 4ef9e176df61f6e1d07a30ec5db3cd2ca8469cc92d3defde73a3f8bf989fc794db67f1c74833189edf769a928e9ca867d37cac55bd0aee5d7a3d49865e2d1dbe
SSDEEP 96:xH4fhTUOPqGqsWfde1b1ObzSGSSladv9jEnIWRbmKnBw88iuE8L4cnTDEMGS:mfwRsWfd6h4SSfRbhnBw887v
TLSH
T1B602FF78A144CFBF64B6766CAC2848715AB2023B7BBF78D610B95885011CF3441FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 b17e94b92dff4bae147cefc0e98a899c7e4a0ec3d7279941835a88d492a9a298
MD5 d8712534cc7df932d64be8d873c0ecfb
SHA1 cd1f33a2f4b50e78137c0c5c2e43aed6def7613c
SHA512 7cbf5127d1b997342de83cbe47747538000bb02ab27e4b0f0e8eeb35ba68553440973414730bad5314c826b39eadfe2583baa423628adfac657e674f0becad4c
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSogBSSladv9jznIHeABw88n8L4cnTDEx:mf5RsWf24PngBSS5eABw88qY
TLSH
T1F0E110789518CB6F74B577ACAC6888316AB2413B7BBF68D710B954C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 7KB
SHA256 c9a871f57b31b4b264c250794e189991ad0160bd2d556907846613ad2967863c
MD5 17f0f0e88e761f41ab1228b41d710eac
SHA1 1fff5e0dab9e9328b3c1776ee6a1a761ec823c72
SHA512 93ed802e354df8e7185f7d771acb920b55a010c79c2a14075d96f58e2ed834cd235b0bbabd41b7f07a762f288fa783752c2cd23eb7180b1a05223cfc412d16f8
SSDEEP 96:xH4fUTUOPqGqsWf2e1b1ObzSGSSladv9jEnIHeABw88n8L4cnTDEMGS:mf5RsWf26h4SSKeABw88qv
TLSH
T14DE1217895188F6F74B6776CAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serviceworker-1.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\serviceworker-1.txt
Size 164B
SHA256 bce38a1b4ae942f4402d7a26e02f70c548535bca3653bad9244e8f80c4825051
MD5 16b9dfc3d7ae8f9c7525fbcfcb54b372
SHA1 ea0138e723b09fe6c069f2f2e8e19fb21bc3e3b3
SHA512 3fd13023651e32fd3b58bbf8366562e8c1298bd5f4a954a08678b668d225c1901b20b2fa6a631b2be88eca17622d582d54145721108ab2de9307f4a469b760e5
TLSH
T1D2C08CE2759271F3AB189CC9407622CF2276A61F0C92A8F464982D93A5EA9718AD4080
MD5 SHA1 SHA512 TLSH

Submit Download

serviceworker.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\serviceworker.txt
Size 149B
SHA256 80228f7d10dab286b3724c8038ab22d0fb7e96f36fcf4de7cb590a315082b818
MD5 174de543d9f1703ec74be56835055e64
SHA1 6ac1b92dbb6d534c52c1b98fccd56b5b76637b7a
SHA512 f2caa5e6ed9d4c064c476e93790ab17b1a705c6bbdbdbde59af638c9bfea3a95a0a5836956f2003d445b9af74fc5621201bbf208c973dd43d2d0c85bc066998b
TLSH
T141C02BD7340271F337149CC9407623CE2276541E0CD29CF444981D6360EB97246D4080
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 685fc744aecfd2bb11a20107c47ff1ea5c143771a84e9c03a161bb97bccf6779
MD5 65b922830674052013173f6dfd7336b5
SHA1 66c4cc72982237479402e5252a463cefdd7c8552
SHA512 8b0eb1c097da12fe7f6f7506cd26af221efecabaa064b6083f88944885f38bb75ee1d9f5ec2b528ddca121ccb30c385fbb3ef3b113824caa23290211d84efce1
TLSH
T1732108426DBB08F5281AB35A38C54BEFC394501A0688F8F4D888E801127DD097BAD60F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 6KB
SHA256 a9983d1a9e9f727072e7b2ecf585d7baf10be6ae8aae3a411a8172b1dac8c63c
MD5 ca8d0237d01ecab601dfbc738a0b61e0
SHA1 02b5149563aec69b953faa916f77e51146e29fde
SHA512 90e95d18c8cf14385223d48a2958677ec75226d4990a92c2cdd26d13b4272f5251d20d3cf548a1050dc6e8cec26e2f4a73cd5c19355db059f87a7daef7c253c2
SSDEEP 192:RpM/xfqDMMeO499mfSur6y0sWIq/jQnm8oiwDWRYGfQ:EFqQMeNHBIUYmVZDWRYT
TLSH
T155E18D91FDC414431B4521CBD4C6B954B4D61C16E6F2598DCF8C773D287A8CA1BA528E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 2bf85e0d5c769d5d2dd941f02ae52fda7fd8d5e840d0b1d572b76949b6985938
MD5 19badea93364ffa1cb90276129d81583
SHA1 f75d3a4c24aca657eeb659dad07a79d6374e1125
SHA512 2d4250c7cdc393633a9e5be9430ab673cefd1551e04dc0363d11b2383c39e782d52fdd0e928f08b88928b96d5c1f3686606e0c414b3c4abf6d23f39f0570ec8d
SSDEEP 96:D2DWMz7mCsDI449Yur4QKXTI9t7aD7vAkv+v3pWsveoiwD/vPi/3ynY:D5MzIDN49YuruotO3jQ5WfoiwD/Xi/v
TLSH
T1F0B16E82EC882147039950C3C8C5DD9AB1FA1416D2F10DD9CE8E5B3919FDDCE59D939B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{c2a06f9f-7d12-4f06-bba9-d30deb48ef99}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\153\{c2a06f9f-7d12-4f06-bba9-d30deb48ef99}.final
Size 1.2MB
SHA256 f0bb6d8dd105dcb5a25d9d8aada04353339333148d562065c0602be54d4e20b1
MD5 265dea0f828b8c9047e4b605b15a8474
SHA1 ecf0dca0c3e9997cc44646b1fabb68e8bf109058
SHA512 ba42396f262c8a8227d106fa5836396b9aee4379e4cd902aaf33760580d007ff30266dc72310fefa30ad9c30832adc224ad3dce9aabc3cf49208df06f356459d
SSDEEP 24576:cR92QBxhc4otG+TfdFJEK3Ff0GzyEau3G4Suo2H8bzxb99YaMMaW0mor:cKchc4Z+TfdFJv+qB24NT8bF9+RMI
TLSH
T1D15523A26201392795B1C2D7EC673451FB814E703F8A99D87766CF681674CC6E3AFB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{766a130c-31fb-405f-8a59-64fdd4dc0bba}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\186\{766a130c-31fb-405f-8a59-64fdd4dc0bba}.final
Size 3KB
SHA256 e048e08330d372e52a7b467ff368768209256a5b22d383ddc75401d6f0533b93
MD5 6fd1a9d6296b4a7d717067533669b74f
SHA1 2138257d06f413da2a5681e729988977b2df913b
SHA512 0a0f0ea6be7e7344318aef2b32c4ced8c239bd2279a4b0e5a0fdcdfe89a14ac05835655ab82d8a4b69ad42cf94fa23b23a9d2e5dc6f0bebf6a1490be186b0c18
TLSH
T11D816C9DBB51E2B1F9BB1DDECD1A50212F3660B149B5C30730A94A63B89018DFDA860F
MD5 SHA1 SHA512 TLSH

Submit Download

{6b8d4de0-fd90-4dc4-a0f1-2fe1c8347d12}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\18\{6b8d4de0-fd90-4dc4-a0f1-2fe1c8347d12}.final
Size 129KB
SHA256 0331798cb3773a25ddfa0e7ce67656116b77c4a8f2e2b3e15bf0ad0216548e53
MD5 039473277ed784c1e35667bbc92fd9fa
SHA1 771e0f990398c1bcf712470dbb84ed4003ab6681
SHA512 b4b19f703a23d8444a4329de554ae5571076c7253e71b6220d7bc012063ce89c900b8250bc8a3db6fbb16393d49e9a827c4c30bcd303059141e2bab269ee95a7
SSDEEP 3072:2ZKDfLrRsSq7w64XX1iLHfSHu2Y5fEs9t0AeeX36:2QreST6EX1ikupVEsf0AeUK
TLSH
T1ECD312B084AA11A6BD111F5B6DF53746E10CBC328A37F8F091AAD96CC2E5DE0D956FC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9bd14ca6-6d0c-4484-83ba-bfbc279b2bda}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\218\{9bd14ca6-6d0c-4484-83ba-bfbc279b2bda}.final
Size 4KB
SHA256 e71125d34c837107929b4521e92e1c6f10c5e2f17cb3a80d189b97731aabb581
MD5 068be87278081ea1c2644abb2ea0028c
SHA1 051f7ba51b95cb8466b4f65498ecd0d68739d221
SHA512 6c6a82f7852f4ed855bffbcb53cc4ea22391963cec502a3b6ad9e284a841514c0748fb75cee848274275b9792337442c20002af979f005559be11506b0124199
SSDEEP 96:XFjRFFqjSpFOgwb5azZBz3obKQarUVuwNlaLZg4M++ijzrBdQUo:dTFqjSpQCRB5ZgJaj/a
TLSH
T1FBA17EB3E9A6AA0FC1F447D239BE2B6C7D697D8360CC08A0C59545D41784181FA9D553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{876e5ed2-f731-4aba-90da-53be4567231f}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\31\{876e5ed2-f731-4aba-90da-53be4567231f}.final
Size 41KB
SHA256 763fe15bc106b84ef071b7a41d3cffcd55164c0490dd2723999d7aa6a7d1218b
MD5 06488f956ff293d158838bcbf2b1322e
SHA1 ea041a870779903999b1e9e05b4bb0538ef19483
SHA512 1cb4fe8420161b13f3a34da06050499febef2f736052c06988e3984d55c2db3628b509bc6a3808b3a05ca649b0edd609309d5ca7a454c185787034771ec98b74
SSDEEP 768:pRrA7wCpNFYK6r2KTT3btgfoo34sTReP834f19P5rrn5xRJf6D:47KyaTGoo35Rekof9rrn5xo
TLSH
T1FC13F1B1026525334BAAB6F0E4C4F5500F984E8243591DE9CB61FEA5E1BF16237D7F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{58562c53-0f49-4e9d-97ba-4f8ebb0b4126}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\38\{58562c53-0f49-4e9d-97ba-4f8ebb0b4126}.final
Size 58KB
SHA256 9732d458af72b359f5b349bd111021c5f1c2af78800d0e7af79bf1aa789a4f62
MD5 ffa2b442539db50dd21cc4631faee93e
SHA1 cd0c9dc4662f9f385ee4ca32f4cf5e09dd3c10ad
SHA512 862c1831d7de78a274ba96c3d8c9a4e149607dc60ac093a03743ee5db4295e516496123882af2f2876a9d33e9de688e39a62c4978519a5bc26aad25502ad8510
SSDEEP 1536:2e9yvF+wmTZw0dsmvGktkpzXhEB5Zi4wf9ekFwbQqe:2rqd0IsXhVr9ubPe
TLSH
T1624302D691C6A00BF5D0E1E5F8AC7F1591C8198B38C002EE1FCAE57B497ADB1C6E6512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ed737826-6934-4187-86a3-5a821ebf9346}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\70\{ed737826-6934-4187-86a3-5a821ebf9346}.final
Size 11KB
SHA256 e1714180f463262ca531c35345a69be0f4f42b09f32fa5967b7ba3ce276c79cf
MD5 ddc8211f520986508e26183006d4d0f0
SHA1 ad696fc9b630d70c7d400436b9ca27023ccdf862
SHA512 5a38d64aba2627a83d14670b91a5bfb52ddfa13cb1491a43be1bb1d2d798707202fa704961b118b98c0be545e04fbfb1959adfa7a919c15397334fcc84dfe123
SSDEEP 192:p8tEQH9gcYe9UPAfBS2qznrbL58GzPYBvZD7VT6m+18eTvthH3pA5ig9FGDhJI:p8HgGzZ+rXnzPYjD95+1vhXK5pFcbI
TLSH
T14D32BF5987E4843AE17667AFE61D5490F01436404FC0ED8B7B4EC0B18C76ED3A3A83B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5c37331b-db21-4561-99dd-526804930257}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\87\{5c37331b-db21-4561-99dd-526804930257}.final
Size 37KB
SHA256 f98e9ae9da070ae6bc190dc7804450a27b929642f23503e0217bb41d7ff515db
MD5 a85f849256c356d55b874f6e336870f0
SHA1 01c1a572b1c82c583af35b5296e71c29620fb53d
SHA512 9b5ff4c0e47a845fd4854315f52231d49a4e2ca82af30d3375d96f5d0088bb0edb804c8205a6cda4b8625340a3896d70284102bfc1bf4153661b0ddeb6cd25d2
SSDEEP 768:oKC66gm+nI0lZRKMjzqDcyZj6QpMmk/5j2dggvV/tcV2tyYjZDRMX9+I/p:o36HmmBdjW4aQmQ2dgQ8cVD5Yp
TLSH
T11103E1F607791537D2619BDF284A819282E15F9A27848EA3FFE1BEB644705C1C733B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{de5abc77-4410-4eb2-8bd2-a8a95d678663}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\cache\morgue\99\{de5abc77-4410-4eb2-8bd2-a8a95d678663}.final
Size 192B
SHA256 04cae3c7b208fc55b25763913d0bbdc99232942086efdf705f2a27764be6f5ee
MD5 2a252393b98be6348c4ba18003cc3471
SHA1 40f75302fcbe4a8ac2e33a8d9daf801abc2a9598
SHA512 07af4a7b0d10f1b5e1fe0877b21abc98483d78797608a1763cfb71e25559fdce10d20f03c16f4284d7ae7ab90266f45240425e3a264de9525ec1657345b85198
TLSH
T113C0225846A8EE3620A3CB3CC827E2820A3B831000498484E6F94A540C8BE850129A01
MD5 SHA1 SHA512 TLSH

Submit Download

3211250388sbwdpsunsohintoatciif.sqlite-wal

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal
Size 40KB
SHA256 ae15173151b55f6e509add744186bcddb352758792b7a3381498dcf0cdd89a3c
MD5 49934d2253fe961a2b32f6be3d1001e0
SHA1 dbd43802c7625dd38e58d735507d3129fe30c8d3
SHA512 62ac44cc7c1fcfb565e1c89715c793f61a1f54346acba6f26416822e311e1ee1f8c8536bcbafafbbe5309e67c92f86b2ed1e03e247517901dce308f96a1b9ead
SSDEEP 192:dkTaRNVTNRNZcTNRNGBOcTNRNJ5PBOcTNRNoT5PBOcTNRN1:FDP+PV
TLSH
T10103DB0D7424D50BCA7085FB42BFD4E1016BB4AE39ED96FB3283578F0C1BB119AA7914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55553889yCt7-%iCt7-%r2e9s5pdo.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\default\https+++www.youtube.com\idb\55553889yCt7-%iCt7-%r2e9s5pdo.sqlite
Size 48KB
SHA256 ca5692917a80ced92eb36c471ca77af5fe860df9b01bafbb08ce6c4cf25ce58c
MD5 da336c8615820f841347b030a245ea72
SHA1 88c907877c065298477aec80e7bfa377a05dfb94
SHA512 8825a2fe69ecf0f33be29fb64e82f7ec5f668f0f8844b316ad016afa197e90c374364ef499b6dd83a7e2874632c33d03234881a3562fa251dbd9eb0f6606e589
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEVH:Oa16S6CKnqlizbxV+2xVeU7X2B0l
TLSH
T13123708E3F07E511C53AF0B178A08D52BC5E321D07222AD579D0D9E4D8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.5MB
SHA256 971eb3a07bf5cfb0dc999c81a8da8710957ffc6b6e20c28e0b678e8c6fb11aae
MD5 392153118738426f52f07ef98e063042
SHA1 7b2dbf2af6ef79705abca44e33b821d2d9d92b1b
SHA512 ad20b61a37a330b340660e285bc0ccdc9fcb062a6ce623dd43229e916dbdbb78f120ba919081e5c0152367d56fbf8f4300ed000c333123beeafd4e54fe98d3a0
SSDEEP 49152:BzvUN2GAMEKFc+d3oR3M+/YRx2uPIOEIlPTA53/K8VDH57I21rIa9mt77NabY4OI:ZvUTAMEKFc+dNQih/
TLSH
T11F665CE460E29252F38140B3719A53EB21EFC00C6077CE44579896FAA5B4CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 589af50b79cec0020224d02335b891524c8c0f6d26467505e709fa9fa7f4654c
MD5 77f84e4863d79d89f9b647faa1b0c759
SHA1 50bf8be021fc66b5adf7cfcc72063b97e2a7f14f
SHA512 11cf196f109818c8c29f2d1002d0253ddc8a6ff19509f91f72a76db3ef62145d2b076c39dc38e4254ac770752a5d2ee5ac1166ea5cb1279d8dd7d4db332762fc
SSDEEP 49152:JDmg2u31A5lUa2lABcNUazvgiRBb4vYIgHB:Zmbu3i56a2ySUazvgixHB
TLSH
T15F1639F820D1A257F3818037668563EB21AFD00C6477DD444BE966F994B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads